SSA-911567: Missing HTTP headers in SINEMA Remote Connect Server before V3.0 SP2
view advisory published 2022-06-14
SINEMA Remote Connect Server is missing HTTP security headers on the web server. This could aid attackers by making the servers more prone to clickjacking, channel downgrade attacks and other similar client-based attack vectors. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-27220US | medium4.3 | — | ||
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server confi… | ||||
| CVE-2022-27219US | medium4.3 | — | ||
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.0 SP2). Affected application is missing general HTTP security headers in the web server confi… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- FixedSINEMA Remote Connect Server
Update to V3.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/ - FixedSINEMA Remote Connect Server
Update to V3.0 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793790/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan